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Change Programme Board Minutes 


Monday 17 J uly 

Members 

Paul Arnold Deputy Chief Executive Officer (Chair) 

Steve wood Deputy Commissioner (Policy) 

James Dipple-Johnstone Deputy Commissioner (Operations) 

Jonathan Bamford Head of Parliament and Government Affairs 

Jo Pedder Head of Policy & Engagement 

Ken Macdonald Head of ICO Regions 

Mike Collins Head of Organisational Development 

Emma Deen Interim Head of Customer and Business 
Services (Business Development) 

Heather Dove Head of Finance 

Rob Parker Head of Corporate Affairs 

Andrew Laing Head of Data Protection Complaints and Reviews 

Steve Eckersley Head of Enforcement 

Anulka Clarke Head of Assurance 

Rachael Cragg Group Manager Change Programme 

Sarah Meyers Change Programme Manager 

Attendees 

Kirsty Keogh Group Manager - Corporate Communications 

Secretariat 

Peter Bloomfield Senior Corporate Governance Manager 


1. Introductions and apologies 

There were apologies from Adam Sowerbutts and Faye Spencer. Kirsty 
Keogh was welcomed to this, her first, meeting of the Change Programme 
Board. 


2. Matters arising from the previous meeting 


Minutes 
The minutes of the previous meeting were agreed. 


Outstanding actions 
The action for managers to ensure that their staff had completed 


the GDPR training was cleared. 


The action on the tracking of progress across the three projects 
would be covered later in the meeting as would the RAID log. 


Rachael Cragg advised that, in respect of the NIS directive and 
creating a backlog, a meeting had taken place on Friday with 
Jonathan Bamford and others and a draft backlog had been created. 
There had not been time to circulate the draft backlog in advance of 
this meeting but it would be circulated shortly. 


3. Monthly project highlight reports 


Service delivery: 

There were material risks in respect of article 29 work on corrective 
measures and there was a meeting scheduled to discuss the issues. 
However, there was no change to the project risk profile. 


Policy and engagement: 
Engagement with the Home Office over the Law Enforcement 
Directive was discussed. 


Enabler/ support: 
Additional accommodation was being sought for up to 70 staff. 


In respect of funding the DCMS consultation on fees should start in 
July. They were using a research company to contact 2,000 
stakeholders about fee ranges. 


In terms of overall risk there were no new risks identified and 
existing risks were being managed. 


4. Programme and project role definitions 


Internal audit had suggested that the ICO defined and clarify 
programme and project roles in greater detail. It was confirmed 
that the circulated document had addressed this. The roles and 
responsibilities allocated within the document were agreed. 


5. Update programme plan 
Key milestones for the programme plan had been identified and 


were being cleared as appropriate. The updated plan would be 
made available on ICON. 


6. Balancing priorities between current and future regimes 


Discussion 

The question was asked as to whether there was anything the ICO 
could stop doing now to allow it to focus resources on new 
priorities? The question did not need answering now, but there was 
a need to think about priorities, and to understand any wider 
implications for the office from any decisions made. 


Decision 

Steering groups and other office groups to consider where resources 
could be better focused. The Change Board would pull together any 
proposed changes with a view to discussion at future boards with 
Senior Leadership Team signing off decisions where needed. 


7. LED impact assessment 


Discussion 

A paper drafted in response to a Home Office Economic Impact 
Assessment questionnaire in respect of the Law Enforcement 
Directive was discussed. 


Decision 

The content of the paper was agreed subject to amendment to the 
title and wording to clarify that the work did not provide an 
economic impact assessment. 


Those involved in preparing the assessment were thanked by the 
Board for their work, especially given the short deadlines. 


9. Communications 
Discussion 
There was discussion on the further work needed on 
communications. 
Actions 


Robert Parker and Rachael Cragg to pull together a communications 
plan for the lead up to the GDPR implementation. 


10. Any other business 


Future work on the Passenger Name Directive and the NIS directive 
was highlighted. 
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Deputy Chief Executive Officer Steering Group minutes 
Thursday 20 J uly 2017 


Members 

Paul Arnold Deputy Chief Executive Officer (Chair) 

Jonathan Bamford Head of Parliament and Government Affairs 

Ken Macdonald Head of ICO Regions 

Mike Collins Head of Organisational Development 

Emma Deen Interim Head of Customer and Business Services 
(Business Development) 

Faye Spencer Interim Head of Customer and Business Services 
(Customer Contact) 

Heather Dove Head of Finance 

Rob Parker Head of Corporate Affairs 

Andrew Laing Head of Data Protection Complaints and Reviews 

Steve Eckersley Head of Enforcement 

David Wells Head of IT 

Secretariat 

Peter Bloomfield Senior Corporate Governance Manager 

1.0 Introductions and apologies 


There were no apologies. 
2.0 Matters arising from the previous meeting 


Minutes 
The minutes were agreed. 


Action Board 
All actions had been cleared. 


3.0 Finance report 


Discussion 

The main point to note was that notification fee income was 
tracking ahead of forecast at the end of Q1, giving us confidence to 
forecast an overall 6% increase for the year compared with 16/17. 
Much of the increase was due to the work done on chasing non- 


payment. The group again offered their thanks to the work of the 
staff in Registration who continued to successfully follow up on late 
payments and to grow the public register. 


Salary spend was within £500 of budget as profiled YTD. The 
forecast included the projected increase in staff numbers. Heather 
Dove and Mike Collins would be monitoring expenditure closely as 
recruitment continued. 


Grant in aid for elDAS expenditure was allocated to the Assurance 
Team. There was no current allocation for enforcement work, 
however, expenditure was reviewed annually and if needed the ICO 
could negotiate for an increase. 


Initiatives not yet budgeted for which arose during the year would 
have to be reviewed against current priorities. All extra expenditure 
would require a virement form or an agreed business case if 
additional budget was required. 


Action 
Heather Dove to amend the Management Board (MB) paper to 
reflect the current position on accommodation negotiations. 


4.0 People strategy 


Discussion 

Headline staff turnover figures appear good in comparison to other 
parts of the public sector at a projected 9% for the year. However, 
our turnover figures are influenced heavily by the growth of the 
organisation as a whole and the headline figure also masks turnover 
approaching 20% in our departments with the greatest face to face 
contact with our key stakeholders. The extra impact of losing staff 
with several years experience was also highlighted. 


There was discussion of the reasons for people leaving the ICO, and 
how best to mitigate the risks and build resilience. 


Michael Collins updated the meeting on other matters including pay 
benchmarking, the on-going pay review and Civil Service Learning. 
In respect of the latter, how to influence the training provided was 
discussed, in particular the London location of much of the training. 
Whilst the training courses themselves were often less expensive 
when booked through CSL, the London centric nature of the training 
providers meant the net cost of the training was often more 
expensive once travel expense was taken into account. The group 
discussed ways to lobby CSL to better reflect the regionally diverse 
locations of their service users. 


Actions 
Michael Collins to consider how best to link turnover to length of 
experience in figures being brought to the steering group. 


Andrew Laing, Jonathan Bamford, Stephen Eckersley and Michael 
Collins to produce a checklist for all departments to consider to help 
them identify areas of low resilience should key staff leave the ICO. 
This checklist then to be used as the basis for a return from all 
departments to the DCEO steering group to give us assurance that 
resilience is being given appropriate priority in our directorate and 
departmental business plans. 


4.1 MB paper re People strategy 


Discussion 

This paper was being discussed prior to coming to MB. Paul Arnold 
highlighted the section on management/leadership development 
work. With the ICO recruiting many new staff and managers there 
was a need to focus on this area and the possibility of providing 
management/leadership development opportunities in quarter three 
was being considered. Paul Arnold acknowledged the general 
pressure on time anticipated during Q3 and he assured the group 
that any management/leadership development planned at that time 
would be on the basis that the short term investment of time was 
also beneficial in helping us cope with our short term challenges as 
managers and leaders. 


The recent work on reward was discussed and Stephen Eckersley 
was asked to re-circulate his work for further comments. 


The possibility of having an “open evening” event to allow potential 
recruits to visit the office and talk to staff was raise, as was 
publishing a matrix of all the anticipated vacancies to be advertised 
during the year. It was felt that this would give both external and 
internal interested parties an opportunity to make informed choices 
about the roles at the ICO they apply for. 


Actions 
Mike Collins to take forward ideas on holding an “open evening” 
event and the publication of a recruitment matrix. 


5.0 DCEO directorate business plan update 


Discussion 
The directorate business plan was presented for information. 


Actions 
Heather Dove to update finance entries in the plan. 


6.0 Risk and opportunity register 


Discussion 
The risk and opportunities register was presented for information. 
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Policy Steering Group minutes 


Tuesday 25 J uly 2017 


Members 

Steve Wood 
Jonathan Bamford 
Ken Macdonald 
Jo Pedder 

Faye Spencer 


Heather Dove 
Adam Sowerbutts 


Anulka Clarke 
Peter Brown 
Kirsty Keogh 


Attendees 
None 


Secretariat 


Catherine Wheeler 


Deputy Commissioner (Policy) (Chair) 

Head of Parliament and Government Affairs 
Head of ICO Regions 

Head of Policy and Engagement 

Interim Head Customer and Business Services 
(Customer Contact) 

Head of Finance 

Head of Freedom of Information Complaints and 
Appeals 

Interim Head of Assurance 

Group Manager (Technology Policy) 

Group Manager (Corporate Communications) 


1. Introductions and apologies 


There were apologies from Richard Marbrow and Robert Parker. 


2. Matters arising from the previous meeting 


Minutes 


There were no matters arising from the previous minutes. 


Action Board 


Completed actions were cleared. 


Proposed updates to the PSG Terms of Reference were agreed. 


Updates were given on each of the outstanding actions: 
e lain Bourne’s actions have been completed and he will attend 
the next PSG he is able to attend to give an update. 
e John Kavanagh's actions are to be carried forward, Jonathan 
Bamford will chase. 
e The outstanding Steve Wood and Jonathan Bamford action to 
be carried forward. 


3. Risks and opportunities 


Discussion 
It was proposed that the Risk Register would be reviewed at each 
meeting with a focus on actions being taken to mitigate the risks. 


It was noted that change focussed risks would be moved to the 
Change Programme’s risk register to avoid duplication. 


The regulatory overlap with other regulators is emerging as a 
possible risk in respect of confusion over roles. 


Decision 

It was agreed than a list of the current and proposed regulators that 
could potentially have overlapping responsibilities with the ICO 
needed to be developed. A ‘road map’ of the overlaps, and who is 
responsibility for what, can then be drafted. 


Actions 

Jonathan Bamford and Jo Pedder to work together to develop a road 
map of where regulatory overlap exists, or could potentially exist, 
between current and proposed regulators for internal use. 


4. Strategic files 


Discussion 
Updates were given on strategic files. 


Adam Stevens is aiming to provide strategic files information and 
updates on ICON to keep staff informed. He has also drafted a 
strategic files process which is with Steve Wood for review before 
coming to the next PSG meeting. 


Some of the strategic files were discussed in depth. 


Rachael Cragg advised that she and Richard Marbrow will be 
reviewing the High Profile Case Procedure. 


In respect of Tasking and Coordinating Groups it was confirmed that 
they were still meeting and Adam Stevens is writing some proposals 
on how they might be improved. 


Decision 
It was agreed that there would be a need in the future to review 
policy issues that have been raised by the handling of strategic files. 


Actions 
Steve Wood to bring the strategic files process document to the 
next PSG meeting for review and comment. 


Steve Wood to send Rachael Cragg the strategic files process 
document for cross-checking with the high profile case procedure. 


5. Priority work streams 


Discussion 
The Policy Work Stream Tracker was reviewed. 


6. Management Board report 


Discussion 

It was noted that each group will be required to provide a report to 
the Senior Leadership Team. Peter Bloomfield has offered to draft 
these reports and send round the PSG for comment. 


7. Research update 


Discussion 
Plans for a Citizens Jury on data analytics were on hold. 


Lisa O'Brien will be leading on the work on computer science 
courses. The first phase is complete and the second phase will be 
started shortly. 


8. Grants programme update 


Discussion 

The opportunity for organisations to bid for a grant will be closing 
this week. A wide range of applications have been received so far. 
There was discussion on the working of the grants programme. 


Heather Dove advised that they could use the “priority payments' 
email to ensure that expenses payments were made to external 
panel members in a timely manner. 


Decision 

It was agreed that there would need to be an update provided to 
stakeholders between the grant application process closing and 
grants being awarded. 


9. Technology update 


Discussion 

The Technology Policy team are currently working on the GDPR and 
Cybersecurity guidance. The mapped DPA technology guidance is 
being reviewed in light of the GDPR as is the privacy in arts and 
technology guidance. 


A report is being drafted on connected devices such as toys. This 
will link into the ICO children’s strategy and consideration of online 
gambling. 


Actions 

Peter Brown to update the Technological Developments & Risks 
Report that sets out near and distant risks coming about as the 
result of new technologies, for the next Steering Group. 


10. Consultation and Select Committee responses 


Discussion 

All were asked to advise Cathy Wheeler of consultation responses 
and parliamentary calls for evidence that are in process so they can 
be included in the report. 


11. Change programme update 


Discussion 
Work on the backlog has been done. 


Rachael Cragg will be taking over governance process updates. 

RAID log updates will be provided to PSG rather than the PSG going 
through the more detailed backlog in every meeting. Rachael Cragg 
will look through the RAID log before each PSG and flag any issues. 


The guidance approval routes need to be considered. It was 
proposed that a guidance sub-group could be created to review and 
work on guidance before it comes to the PSG for sign-off. 


Actions 
Jo Pedder to bring a proposal for possible guidance sign-off routes 
to the next PSG. 


12. Any other business 


Discussion 

It was asked if to whether there are ways for changes to the EUDPR 
Knowledge Base to be flagged up. The network meeting 
representatives should be disseminating the changes being made to 
their team. 


Work is being done on producing a second staff survey to measure 
staff EUDPR knowledge levels. 


Actions 
Rachael Cragg will ensure the EUDPR knowledge base which is on 
ICON is made more obvious to staff. 


Rachael Cragg to ensure that a spreadsheet of EUDPR queries that 
have been raised but not yet answered is made available. 
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Operations Steering Group minutes 


Thursday 27 J uly 2017 

Members 

James Dipple-Johnstone Deputy Commissioner (Operations) 

Jo Pedder Head of Policy and Engagement 

Emma Deen Interim Head of Customer and Business 
Services (Business Development) 

Faye Spencer Interim Head of Customer and Business 
Services (Customer Contact) 

Andrew Laing Head of Data Protection Complaints and 
Reviews 

Adam Sowerbutts Head of Freedom of Information Complaints 
and Appeals 

Steve Eckersley Head of Enforcement 

Anulka Clarke Interim Head of Assurance 

Robert Parker Head of Corporate Affairs 

Richard Marbrow Corporate Governance Group Manager 

Secretariat 

Peter Bloomfield Senior Corporate Governance Manager 


1. Introductions and apologies 


James Dipple-Johnstone welcomed members to this, his first, steering 
group meeting. 


2. Matters arising from the previous meeting 


Minutes 
The minutes were agreed. 


Actions and decisions 
There were no outstanding actions. 


3. Operations summary report 


Discussion 
The statistics report was presented covering both freedom of 
information and data protection work. 


Decision 

It agreed that when relevant the draft operational statistics report 
for Management Board would come to the preceding steering group 
meeting. 


The report currently provides figures back to 2009. There was 
currently a need for this but providing figures that far back should 
be reviewed in the next few months. 


Actions 

Corporate Governance to talk to lain Campbell about the provision 
of a monthly statistical report (including Enforcement and 
Assurance work) coming to come to the Steering Group. This would 
include where appropriate the Management Board report. 


All members to consider what management information comes to 
the monthly meetings and to raise suggestions at the next meeting. 


4. Verbal updates - Operations Heads of Department 


Discussion 
Enforcement 
Steve Eckersley advised the group on: 
e intake 
e high profile cases and the need to review procedures 
e the need for GDPR procedures to be developed and 
e recruitment of new staff. 


Assurance 
Anulka Clarke advised that (amongst other matters): 
e the final DRIPA audit had been completed 
e the second release of the SME toolkit had been completed 
(release 3 covering GDPR was being developed) 
e work was ongoing on Binding Corporate Rules and 
e audit processes were being reviewed. 


Data Protection Complaints and Reviews 

Andy Laing reported the highest receipts and closures ever in 
quarter 1. There followed discussion on the need to keep up on 
current workloads and to prepare for GDPR implementation. The 
recruitment and induction of new staff would be a major issue. 


There was also discussion as to how best to promote GDPR 
compliance with data controllers by better use of the website. 


Freedom of Information Complaints and Appeals 
Adam Sowerbutts updated the group on first quarter performance 
for the department: 
e Workloads were variable over the quarter and in need of close 
monitoring. 
e Appeals volumes are as expected 
e The team is recruiting for another solicitor and there is a need 
to recruit at levels C and D. 


Actions 

Andy Laing and Jo Pedder to consider how best to promote GDPR 
compliance to data controllers, feeding back to this and the 
Communications Steering Group. 


5. Risks and opportunities 


Discussion 
Richard Marbrow explained the new format for the risk and 
opportunity register and the process for updating the register. 


6. Department business plans 


Discussion 
James Dipple-J ohnstone introduced the first draft of the Directorate 
Business Plan for any initial comments. 


The need to review some of the measures was identified. This was 
to be taken outside the meeting. 


It was also noted that joining up core skills training (ie difficult 
customer and investigations training) would be useful. 


7. Steering Group terms of reference 


Discussion 

The terms of reference for the steering group had been updated to 
reflect changes in membership (the addition of Richard Marbrow 
and Simon Entwisle), changes in meeting frequency and the 
management information being provided. The wording referring to 
Policy Directorate members needed tightening up. 


Action 
Peter Bloomfield to ensure the terms of reference were updated. 


8. Any other business 


The question of coordinating recruitment to ICO vacancies better was 
raised. Michael Collins has an action point from DCEO SG to look at this. 


The inclusion in the operational statistics of Enforcement and Assurance 
work was also raised. 


